-
Notifications
You must be signed in to change notification settings - Fork 11.6k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
VirtualUse of type UseKind::Inter expects the definition of a llvm::Value to be represented in another statement. In the bug report that statement has been removed due to its domain being empty. Scop::InstStmtMap for the llvm::Value's defintion still pointed to the removed statement, which resulted in the use-after-free. The defintion statement was removed by Simplify because it was considered to not be reachable by other uses; trivially because it is never executed due to its empty domain. However, no such thing happend to the using statement using the value altough its domain is also empty. Fix by always removing statements with empty domains in Simplify since these are not properly analyzable. A UseKind::Inter should always have a statement with its defintion due to LLVM's SSA form. Scop::removeStmtNotInDomainMap() also removes statements with empty domains but does so without considering the context as used by Simplify's analyzes. In another angle, InstStmtMap pointing to removed statements should not happen either and ForwardOpTree would have bailed out if the llvm::Value definition was not represented by a statement. This will be corrected in a followup-commit. This fixes llvm.org/PR47098
- Loading branch information
1 parent
901e331
commit 6983741
Showing
3 changed files
with
136 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,82 @@ | ||
; RUN: opt %loadPolly -polly-simplify -polly-optree -analyze < %s | FileCheck %s -match-full-lines | ||
|
||
; llvm.org/PR47098 | ||
; Use-after-free by reference to Stmt remaining in InstStmtMap after removing it has been removed by Scop::simplifyScop. | ||
; Removal happened in -polly-simplify, Reference was using in -polly-optree. | ||
; Check that Simplify removes the definition of %0 as well of its use. | ||
|
||
target datalayout = "e-m:w-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128" | ||
target triple = "x86_64-pc-windows-msvc19.26.28806" | ||
|
||
@"?var_27@@3JA" = external dso_local local_unnamed_addr global i32, align 4 | ||
@"?var_28@@3HA" = external dso_local local_unnamed_addr global i32, align 4 | ||
|
||
; Function Attrs: nofree norecurse nounwind uwtable | ||
define dso_local void @"?test@@YAXHEQEAY3M@1BI@BJ@H@Z"(i32 %a, i8 %b, [12 x [2 x [24 x [25 x i32]]]]* nocapture readonly %c) local_unnamed_addr { | ||
entry: | ||
br label %entry.split | ||
|
||
entry.split: ; preds = %entry | ||
%sext = shl i32 %a, 16 | ||
%conv4 = ashr exact i32 %sext, 16 | ||
%sub = add nsw i32 %conv4, -25941 | ||
%cmp535 = icmp sgt i32 %sext, 1700069376 | ||
br i1 %cmp535, label %for.cond8.preheader.lr.ph, label %for.cond.cleanup.critedge | ||
|
||
for.cond8.preheader.lr.ph: ; preds = %entry.split | ||
%conv10 = zext i8 %b to i64 | ||
%sub11 = add nsw i64 %conv10, -129 | ||
%cmp1232.not = icmp eq i64 %sub11, 0 | ||
br i1 %cmp1232.not, label %for.cond8.preheader, label %for.cond8.preheader.us | ||
|
||
for.cond8.preheader.us: ; preds = %for.cond8.preheader.lr.ph, %for.cond8.for.cond.cleanup13_crit_edge.us | ||
%e.036.us = phi i16 [ %add.us, %for.cond8.for.cond.cleanup13_crit_edge.us ], [ 0, %for.cond8.preheader.lr.ph ] | ||
%idxprom.us = sext i16 %e.036.us to i64 | ||
br label %for.body14.us | ||
|
||
for.body14.us: ; preds = %for.cond8.preheader.us, %for.body14.us | ||
%indvars.iv = phi i64 [ 0, %for.cond8.preheader.us ], [ %indvars.iv.next, %for.body14.us ] | ||
%arrayidx19.us = getelementptr inbounds [12 x [2 x [24 x [25 x i32]]]], [12 x [2 x [24 x [25 x i32]]]]* %c, i64 6, i64 2, i64 1, i64 %idxprom.us, i64 %indvars.iv | ||
%0 = load i32, i32* %arrayidx19.us, align 4, !tbaa !3 | ||
store i32 0, i32* @"?var_28@@3HA", align 4, !tbaa !3 | ||
%indvars.iv.next = add nuw nsw i64 %indvars.iv, 1 | ||
%exitcond.not = icmp eq i64 %indvars.iv.next, %sub11 | ||
br i1 %exitcond.not, label %for.cond8.for.cond.cleanup13_crit_edge.us, label %for.body14.us | ||
|
||
for.cond8.for.cond.cleanup13_crit_edge.us: ; preds = %for.body14.us | ||
%add.us = add i16 %e.036.us, 4 | ||
%conv2.us = sext i16 %add.us to i32 | ||
%cmp5.us = icmp sgt i32 %sub, %conv2.us | ||
br i1 %cmp5.us, label %for.cond8.preheader.us, label %for.cond.cleanup.critedge.loopexit38 | ||
|
||
for.cond.cleanup.critedge.loopexit38: ; preds = %for.cond8.for.cond.cleanup13_crit_edge.us | ||
store i32 %0, i32* @"?var_27@@3JA", align 4, !tbaa !7 | ||
br label %for.cond.cleanup.critedge | ||
|
||
for.cond.cleanup.critedge: ; preds = %for.cond8.preheader, %for.cond.cleanup.critedge.loopexit38, %entry.split | ||
ret void | ||
|
||
for.cond8.preheader: ; preds = %for.cond8.preheader.lr.ph, %for.cond8.preheader | ||
%e.036 = phi i16 [ %add, %for.cond8.preheader ], [ 0, %for.cond8.preheader.lr.ph ] | ||
%add = add i16 %e.036, 4 | ||
%conv2 = sext i16 %add to i32 | ||
%cmp5 = icmp sgt i32 %sub, %conv2 | ||
br i1 %cmp5, label %for.cond8.preheader, label %for.cond.cleanup.critedge | ||
} | ||
|
||
!3 = !{!4, !4, i64 0} | ||
!4 = !{!"int", !5, i64 0} | ||
!5 = !{!"omnipotent char", !6, i64 0} | ||
!6 = !{!"Simple C++ TBAA"} | ||
!7 = !{!8, !8, i64 0} | ||
!8 = !{!"long", !5, i64 0} | ||
|
||
|
||
; CHECK: Statistics { | ||
; CHECK: Empty domains removed: 2 | ||
; CHECK: } | ||
|
||
; CHECK: After accesses { | ||
; CHECK-NOT: Stmt_for_body14_us_a | ||
; CHECK-NOT: Stmt_for_body14_us | ||
; CHECK: } |